Innovation is a constant in life, the development of technology allows investigations to be more practical and agile in every way, digital forensic investigations do not escape from it. In the following article we explain how is a case of investigation of a person in the new digital connected era.
In the conference introduction to digital forensics, Rodolfo Salazar, CEO and president of IdeaWorks International described the steps to be able to carry out the construction of an investigative case.
– The starting point to gather evidence are the routes and profiles, i.e. to investigate the path that could have been used to carry out any licit or illicit act and the profiles of the possible perpetrators.
– Develop descriptions of actors or facts based on the information gathered in the investigation in addition to the variables of the environment.
– Observations, existence of patterns and correlations between facts, clues and evidence found.
– Data to direct or redirect efforts and resources.
“Profiles or routes will provide only a general idea of the facts people and situations involved, they should never be conclusive until we have the complete evidence,” Salazar stresses.
Skram Method
The SKRAM Model is a method created in 1998 by Donn Parker, which was described in his book “Fighting Computer Crime: a New Framework for Protecting Information”, becoming one of the most used and valuable tools when starting any type of computer attack investigation.
Parker named the Skram model as an acronym for Skills, Knowledge, Resources, Authority and Motive.
This means that before making a judgment or creating assumptions about computer crimes, a study must be made of the skills, knowledge, resources, authority and motives of the suspects and, based on this, more people must be ruled out or included.
Salazar closed the conference with a message for all students in a case of investigating a person in the new digital connected era.
“Digital forensics is not about technology, it is about the attitude with which you carry out the investigation. Because technology is solved by experts. The technological issue, if you are clear about the route and premises, you can have someone to help you have all the technical part,” he said.